Sec. 143. Notice to law enforcement

408 words·~2 min read·/bill/113/hr/4711/ih/section-143

A research copy — for the controlling text, always check the official state or federal source. Not legal advice.

Not later than 60 days after the date of the enactment of this Act, the Secretary of Homeland Security shall designate a Federal Government entity to receive notice under this section. A covered entity shall notify the designated entity of a breach of security if— the number of individuals whose personally identifiable information was, or is reasonably believed to have been, acquired or accessed as a result of the breach of security exceeds 10,000; the breach of security involves a database, networked or integrated databases, or other data system containing the personally identifiable information of more than 1,000,000 individuals; the breach of security involves databases owned by the Federal Government; or the breach of security involves primarily personally identifiable information of individuals known to the covered entity to be employees or contractors of the Federal Government involved in national security or law enforcement.

Each notice under subsection

(b)shall contain the following: The date, estimated date, or estimated date range of the breach of security. A description of the nature of the breach of security. A description of each type of personally identifiable information that was or is reasonably believed to have been acquired or accessed as a result of the breach of security. A statement of each paragraph under subsection

(b)that applies to the breach of security. Nothing in this section shall be construed to require a covered entity to reveal specific or identifying information about an individual as part of the notice under paragraph (1). The designated entity shall promptly provide each notice it receives under subsection

(b)to the following: The United States Secret Service. The Federal Bureau of Investigation. The Commission. The United States Postal Inspection Service, if the breach of security involves mail fraud. The attorney general of each State affected by the breach of security. Such other Federal agencies as the designated entity considers appropriate for law enforcement, national security, or data security purposes. Notice under this section shall be delivered as follows: Notice under subsection

(b)shall be delivered as promptly as possible, but— not less than 3 business days before notification to an individual under section 142(a)(1); and not later than 10 days after the date of discovery of the events requiring notice. Notice under subsection

(d)shall be delivered as promptly as possible, but not later than 1 business day after the date that the designated entity receives notice of a breach of security from a covered entity.